deepagents-code 0.1.32__tar.gz → 0.1.33__tar.gz

{deepagents_code-0.1.32 → deepagents_code-0.1.33}/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 # Deep Agents Code Changelog
 
+## [0.1.33](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.32...deepagents-code==0.1.33) (2026-07-06)
+
+### Features
+
+* In-the-moment trust prompt for symlinked skills ([#4200](https://github.com/langchain-ai/deepagents/issues/4200)) ([a4431e4](https://github.com/langchain-ai/deepagents/commit/a4431e4339348431e91533cb2b177259ab94b083))
+* Selective per-server project MCP trust ([#4507](https://github.com/langchain-ai/deepagents/issues/4507)) ([aaa22a9](https://github.com/langchain-ai/deepagents/commit/aaa22a9340cb3d2c8e9ce1a921957d0a9121da20))
+* Add `dcode tools list` command ([#4461](https://github.com/langchain-ai/deepagents/issues/4461)) ([1402d0e](https://github.com/langchain-ai/deepagents/commit/1402d0e735a1580503f240457c77db76fcd779d7))
+
+### Bug Fixes
+
+* Strip media placeholders from model-facing message text ([#4462](https://github.com/langchain-ai/deepagents/issues/4462)) ([aa0ae36](https://github.com/langchain-ai/deepagents/commit/aa0ae36b00df6411a9200610a9075ef2dc28b1af))
+* Re-apply theme preference on `/reload` ([#4514](https://github.com/langchain-ai/deepagents/issues/4514)) ([5d1c392](https://github.com/langchain-ai/deepagents/commit/5d1c3928f7ca0ea97f28fd4d34ae1a4ee885e888))
+
 ## [0.1.32](https://github.com/langchain-ai/deepagents/compare/deepagents-code==0.1.31...deepagents-code==0.1.32) (2026-07-06)
 
 ### Features

{deepagents_code-0.1.32 → deepagents_code-0.1.33}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepagents-code
-Version: 0.1.32
+Version: 0.1.33
 Summary: Terminal interface for Deep Agents - interactive AI agent with file operations, shell access, and sub-agent capabilities.
 Project-URL: Homepage, https://docs.langchain.com/oss/python/deepagents/overview
 Project-URL: Documentation, https://reference.langchain.com/python/deepagents/
@@ -27,10 +27,10 @@ Classifier: Topic :: Terminals
 Requires-Python: <4.0,>=3.11
 Requires-Dist: aiosqlite<1.0.0,>=0.22.1
 Requires-Dist: deepagents-acp<1.0.0,>=0.0.8
-Requires-Dist: deepagents==0.7.0a3
+Requires-Dist: deepagents==0.7.0a4
 Requires-Dist: httpx<1.0.0,>=0.28.1
 Requires-Dist: langchain-anthropic<2.0.0,>=1.4.7
-Requires-Dist: langchain-google-genai<5.0.0,>=4.2.6
+Requires-Dist: langchain-google-genai<5.0.0,>=4.2.7
 Requires-Dist: langchain-mcp-adapters<1.0.0,>=0.3.0
 Requires-Dist: langchain-openai<2.0.0,>=1.3.3
 Requires-Dist: langchain-quickjs<0.4.0,>=0.3.2
@@ -67,7 +67,7 @@ Requires-Dist: langchain-baseten<1.0.0,>=0.2.1; extra == 'all-providers'
 Requires-Dist: langchain-cohere<1.0.0,>=0.6.0; extra == 'all-providers'
 Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'all-providers'
 Requires-Dist: langchain-fireworks<2.0.0,>=1.4.3; extra == 'all-providers'
-Requires-Dist: langchain-google-genai<5.0.0,>=4.2.6; extra == 'all-providers'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.2.7; extra == 'all-providers'
 Requires-Dist: langchain-google-vertexai<4.0.0,>=3.2.4; extra == 'all-providers'
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'all-providers'
 Requires-Dist: langchain-huggingface<2.0.0,>=1.2.2; extra == 'all-providers'
@@ -102,7 +102,7 @@ Requires-Dist: langchain-deepseek<2.0.0,>=1.1.0; extra == 'deepseek'
 Provides-Extra: fireworks
 Requires-Dist: langchain-fireworks<2.0.0,>=1.4.3; extra == 'fireworks'
 Provides-Extra: google-genai
-Requires-Dist: langchain-google-genai<5.0.0,>=4.2.6; extra == 'google-genai'
+Requires-Dist: langchain-google-genai<5.0.0,>=4.2.7; extra == 'google-genai'
 Provides-Extra: groq
 Requires-Dist: langchain-groq<2.0.0,>=1.1.3; extra == 'groq'
 Provides-Extra: huggingface

{deepagents_code-0.1.32 → deepagents_code-0.1.33}/THREAT_MODEL.md

@@ -232,7 +232,7 @@
 
 #### TB4: MCP Config → Process / Network
 
-- **Inside**: `mcp_tools._validate_server_config` validates JSON structure and field types. `mcp_trust.compute_config_fingerprint` computes SHA-256 over config file contents. Project-level stdio servers require trust approval (fingerprint prompt) unless `--trust-project-mcp` is set.
+- **Inside**: `mcp_tools._validate_server_config` validates JSON structure and field types. `mcp_trust.compute_config_fingerprint` computes SHA-256 over config file contents. Project-level stdio servers require trust approval (fingerprint prompt) unless `--trust-project-mcp` is set. A user can selectively pre-approve or reject individual project servers by name via `[mcp].enabled_project_servers` / `disabled_project_servers` (or the `DEEPAGENTS_CODE_ENABLED_PROJECT_MCP_SERVERS` / `..._DISABLED_...` env vars); reject wins over approval and over full trust. These lists are read by `model_config.load_mcp_server_trust_lists` only from user-controlled sources — the user-level `~/.deepagents/config.toml`, the global `~/.deepagents/.env`, and shell-exported env — never from `.mcp.json` or any repo-committed file, so a committed config cannot self-approve its own servers. In particular, the env forms (`DEEPAGENTS_CODE_ENABLED_PROJECT_MCP_SERVERS` / `..._DISABLED_...`) are added to `config._PROJECT_DOTENV_DENIED_ENV_KEYS`, so a committed *project* `.env` cannot inject them into `os.environ` even though it is loaded at bootstrap. Enabled resolves env-over-TOML, but disabled *unions* TOML and env so a deny can never be silently emptied by the other source. If the user's `config.toml` exists but cannot be read or parsed, the loader fails closed (project configs are treated as untrusted and the error is surfaced) rather than proceeding with an empty deny list. Only allowlisted (or fully trusted) names survive into the merged config, so a non-allowlisted remote entry is never preflighted and its interpolated headers are never resolved. Note that the allow list binds by server *name*, not by fingerprint: an allowlisted name is loaded whatever definition the repo currently gives it, bypassing the fingerprint change-detection that re-prompts on full-config trust — so users should only allowlist names in repos they would otherwise trust.
 - **Outside**: Stdio server `command`, `args`, and `env` fields are user-controlled strings passed directly to `StdioConnection`. The `env` dict from MCP config is forwarded without filtering — users can set arbitrary environment variables (including `PATH`, `LD_PRELOAD`, `PYTHONPATH`) for the MCP subprocess.
 - **Crossing mechanism**: `subprocess.Popen` (via `langchain_mcp_adapters`) for stdio; HTTP/SSE for remote servers.
 

{deepagents_code-0.1.32 → deepagents_code-0.1.33}/deepagents_code/_build_info.py

@@ -1,3 +1,3 @@
 """Generated at build time. Do not edit or commit."""
 
-BUILD_COMMIT = "9d4d7ba"
+BUILD_COMMIT = "0199007"

{deepagents_code-0.1.32 → deepagents_code-0.1.33}/deepagents_code/_env_vars.py

@@ -93,6 +93,42 @@ real PyPI release.
 Any non-empty value enables the flag (including `"0"` or `"false"`).
 """
 
+DISABLED_PROJECT_MCP_SERVERS = "DEEPAGENTS_CODE_DISABLED_PROJECT_MCP_SERVERS"
+"""Comma-separated project MCP server names to always reject by name.
+
+A user-level equivalent of `[mcp].disabled_project_servers`.
+
+Rejection wins over approval: a name listed here is dropped even when it also
+appears in `ENABLED_PROJECT_MCP_SERVERS` (or `[mcp].enabled_project_servers`)
+and even when the project config is otherwise trusted. Unlike the enabled list,
+this env var *unions* with (rather than replaces)
+`[mcp].disabled_project_servers` — denies accumulate across sources, so neither
+can silently empty a deny set in the other. This is process env the user
+controls, not a repo file, so it does not weaken the user-level-only
+trust boundary: a committed *project* `.env` is blocked from setting it
+(see `config._PROJECT_DOTENV_DENIED_ENV_KEYS`); only the user's shell,
+launch env, or global `~/.deepagents/.env` can.
+"""
+
+ENABLED_PROJECT_MCP_SERVERS = "DEEPAGENTS_CODE_ENABLED_PROJECT_MCP_SERVERS"
+"""Comma-separated project MCP server names to pre-approve by name.
+
+A user-level equivalent of `[mcp].enabled_project_servers`.
+
+Servers named here load from an otherwise-untrusted project `.mcp.json` without
+prompting (they are omitted from the interactive approval prompt), while
+non-listed servers stay dropped. Like `DISABLED_PROJECT_MCP_SERVERS`, this is
+user-controlled process env, not a repo file, so it does not weaken
+the user-level-only trust boundary (a committed *project* `.env` cannot set it;
+see `config._PROJECT_DOTENV_DENIED_ENV_KEYS`). This contract is name-based:
+a project command or URL change under the same server name still matches.
+
+When set, this replaces (takes precedence over) the
+`[mcp].enabled_project_servers` TOML list.
+(`DISABLED_PROJECT_MCP_SERVERS` instead *unions* with its TOML list, so a deny
+is never silently emptied.)
+"""
+
 EXTERNAL_EVENT_SOCKET = "DEEPAGENTS_CODE_EXTERNAL_EVENT_SOCKET"
 """Enable the local Unix-socket external event listener.
 

deepagents_code-0.1.33/deepagents_code/_fake_models.py

@@ -0,0 +1,66 @@
+"""Fake chat model base shared by integration tests and tool enumeration.
+
+Holds the tool-binding base that both the local integration-test fakes
+(`_testing_models`) and the `dcode tools list` tool-enumeration path
+(`tool_catalog._CatalogModel`) build on. It lives in a use-neutral module — not
+under a `_testing_`-prefixed name — so a production import path never depends on
+something that reads as test-only and might be pruned or excluded from the wheel.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from langchain_core.language_models.fake_chat_models import GenericFakeChatModel
+from pydantic import Field
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Sequence
+
+    from langchain_core.language_models import LanguageModelInput
+    from langchain_core.messages import AIMessage
+    from langchain_core.runnables import Runnable
+    from langchain_core.tools import BaseTool
+
+
+_TOOL_BINDING_MODEL_PROFILE: dict[str, Any] = {
+    "tool_calling": True,
+    "max_input_tokens": 8000,
+}
+"""Minimal capability profile the agent runtime reads while compiling a model.
+
+Only `tool_calling` is load-bearing — the agent negotiates tool support at
+setup. `max_input_tokens` is part of the profile surface but inert here: these
+models are compiled to bind tools and are never invoked, so no token budget ever
+applies. Defined once so both the integration-test fakes and
+`tool_catalog._CatalogModel` share a single source of truth.
+"""
+
+
+class _ToolBindingFakeModel(GenericFakeChatModel):
+    """Base for fake chat models that must bind tools but are never invoked.
+
+    The agent runtime calls `model.bind_tools(schemas)` and reads `model.profile`
+    while compiling the graph, and a bare `GenericFakeChatModel` cannot be
+    compiled into an agent graph: it inherits `BaseChatModel.bind_tools`, which
+    raises `NotImplementedError`, and its `profile` is `None`, which breaks
+    capability negotiation. This base supplies a no-op `bind_tools` passthrough
+    and a minimal `profile`, leaving subclasses to add generation behavior
+    (tests) or nothing at all (tool enumeration).
+    """
+
+    # Required by `GenericFakeChatModel`, but subclasses never consume it.
+    messages: object = Field(default_factory=lambda: iter(()))
+    profile: dict[str, Any] | None = Field(
+        default_factory=lambda: dict(_TOOL_BINDING_MODEL_PROFILE)
+    )
+
+    def bind_tools(
+        self,
+        tools: Sequence[dict[str, Any] | type | Callable | BaseTool],  # noqa: ARG002
+        *,
+        tool_choice: str | None = None,  # noqa: ARG002
+        **kwargs: Any,  # noqa: ARG002
+    ) -> Runnable[LanguageModelInput, AIMessage]:
+        """Return self so the agent can bind tool schemas without a real model."""
+        return self

{deepagents_code-0.1.32 → deepagents_code-0.1.33}/deepagents_code/_testing_models.py

@@ -1,21 +1,23 @@
-"""Internal chat models used by local integration tests."""
+"""Internal fake chat models for local integration tests.
+
+The tool-binding base these build on (`_fake_models._ToolBindingFakeModel`) is
+factored out into a use-neutral module so the `dcode tools list` enumeration
+path can reuse it without importing this test-named module.
+"""
 
 from __future__ import annotations
 
 from typing import TYPE_CHECKING, Any
 
-from langchain_core.language_models.fake_chat_models import GenericFakeChatModel
 from langchain_core.messages import AIMessage, BaseMessage
 from langchain_core.outputs import ChatGeneration, ChatResult
-from pydantic import Field
+
+from deepagents_code._fake_models import _ToolBindingFakeModel
 
 if TYPE_CHECKING:
-    from collections.abc import Callable, Sequence
+    from collections.abc import Callable
 
     from langchain_core.callbacks import CallbackManagerForLLMRun
-    from langchain_core.language_models import LanguageModelInput
-    from langchain_core.runnables import Runnable
-    from langchain_core.tools import BaseTool
 
 
 # Prompt markers that drive `ToolCallingIntegrationChatModel`. Each marker is the
@@ -33,13 +35,13 @@ TOP_LEVEL_WRITE_CONTENT = "auto-approved"
 SUBAGENT_WRITE_CONTENT = "auto-approved-subagent"
 
 
-class DeterministicIntegrationChatModel(GenericFakeChatModel):
+class DeterministicIntegrationChatModel(_ToolBindingFakeModel):
     """Deterministic chat model for integration tests.
 
-    This subclasses LangChain's `GenericFakeChatModel` so the implementation
-    stays aligned with the core fake-chat-model test surface, while overriding
-    generation to remain prompt-driven and restart-safe for real CLI server
-    integration tests.
+    This subclasses `_ToolBindingFakeModel` (itself a `GenericFakeChatModel`) so
+    the implementation stays aligned with the core fake-chat-model test surface,
+    while overriding generation to remain prompt-driven and restart-safe for real
+    CLI server integration tests.
 
     Why the existing `langchain_core` fakes cannot be reused here:
 
@@ -53,13 +55,15 @@ class DeterministicIntegrationChatModel(GenericFakeChatModel):
         identical output regardless of process lifecycle.
 
     2. The agent runtime calls `model.bind_tools(schemas)` during
-        initialization. None of the core fakes implement `bind_tools`, so they
-        raise `AttributeError` in any agent-loop context. This model provides a
+        initialization. A bare `GenericFakeChatModel` inherits
+        `BaseChatModel.bind_tools`, which raises `NotImplementedError` in any
+        agent-loop context. The inherited `_ToolBindingFakeModel` supplies a
         no-op passthrough.
 
     3. The app server reads `model.profile` for capability negotiation (e.g.
-        `tool_calling`, `max_input_tokens`). Core fakes have no such attribute,
-        causing `AttributeError` or silent misconfiguration at runtime.
+        `tool_calling`, `max_input_tokens`). A bare fake's `profile` is `None`,
+        causing silent misconfiguration at runtime. The inherited
+        `_ToolBindingFakeModel` supplies a minimal profile.
 
     Additionally, the compact middleware issues summarization prompts mid-
     conversation. A list-based model cannot distinguish these from normal user
@@ -68,24 +72,8 @@ class DeterministicIntegrationChatModel(GenericFakeChatModel):
     """
 
     model: str = "fake"
-    # Required by `GenericFakeChatModel`, but our override does not consume it.
-    messages: object = Field(default_factory=lambda: iter(()))
-    profile: dict[str, Any] | None = Field(
-        default_factory=lambda: {
-            "tool_calling": True,
-            "max_input_tokens": 8000,
-        }
-    )
-
-    def bind_tools(
-        self,
-        tools: Sequence[dict[str, Any] | type | Callable | BaseTool],  # noqa: ARG002
-        *,
-        tool_choice: str | None = None,  # noqa: ARG002
-        **kwargs: Any,  # noqa: ARG002
-    ) -> Runnable[LanguageModelInput, AIMessage]:
-        """Return self so the agent can bind tool schemas during tests."""
-        return self
+    # `messages`, `profile`, and the `bind_tools` passthrough are inherited from
+    # `_ToolBindingFakeModel`; this model adds only prompt-driven generation.
 
     def _generate(
         self,

{deepagents_code-0.1.32 → deepagents_code-0.1.33}/deepagents_code/_version.py

@@ -2,7 +2,7 @@
 
 # Keep the `x-release-please-version` annotation — release-please uses it to
 # bump `__version__` in sync with `pyproject.toml` on every release PR.
-__version__ = "0.1.32"  # x-release-please-version
+__version__ = "0.1.33"  # x-release-please-version
 
 DOCS_URL = "https://docs.langchain.com/oss/python/deepagents/code"
 """URL for `deepagents-code` documentation."""

{deepagents_code-0.1.32 → deepagents_code-0.1.33}/deepagents_code/agent.py

@@ -1702,6 +1702,9 @@ def create_cli_agent(
             )
             raise ValueError(msg)
         # Lazy import keeps `dcode -v` fast — see AGENTS.md startup-perf rule.
+        from langchain_core._api import (  # noqa: PLC2701  # re-exported in _api.__all__
+            suppress_langchain_beta_warning,
+        )
         from langchain_quickjs import CodeInterpreterMiddleware, PTCOption
 
         ptc_names = _resolve_ptc_option(
@@ -1713,16 +1716,20 @@ def create_cli_agent(
         ptc_option: PTCOption | None = (
             cast("PTCOption", list(ptc_names)) if ptc_names is not None else None
         )
-        agent_middleware.append(
-            CodeInterpreterMiddleware(
-                tool_name="js_eval",
-                timeout=settings.interpreter_timeout_seconds,
-                memory_limit=settings.interpreter_memory_limit_mb * 1024 * 1024,
-                max_ptc_calls=settings.interpreter_max_ptc_calls,
-                max_result_chars=settings.interpreter_max_result_chars,
-                ptc=ptc_option,
+        # `CodeInterpreterMiddleware` is decorated `@beta()`, which emits a
+        # `LangChainBetaWarning` on every instantiation. We intentionally use it
+        # and the warning is not actionable for users, so suppress it.
+        with suppress_langchain_beta_warning():
+            agent_middleware.append(
+                CodeInterpreterMiddleware(
+                    tool_name="js_eval",
+                    timeout=settings.interpreter_timeout_seconds,
+                    memory_limit=settings.interpreter_memory_limit_mb * 1024 * 1024,
+                    max_ptc_calls=settings.interpreter_max_ptc_calls,
+                    max_result_chars=settings.interpreter_max_result_chars,
+                    ptc=ptc_option,
+                )
             )
-        )
 
     # Local context middleware (git info, directory tree, etc.).
     if isinstance(backend, (_ExecutableBackend, _AsyncExecutableBackend)):

{deepagents_code-0.1.32 → deepagents_code-0.1.33}/deepagents_code/app.py

@@ -279,6 +279,11 @@ def _create_model_with_deepagents_import_lock(
         )
 
 
+def _resolve_parent_dir(path: str | Path) -> str:
+    """Return the resolved parent directory for a path."""
+    return str(Path(path).resolve().parent)
+
+
 def _extra_is_ready(extra: str) -> bool | None:
     """Return whether all dependencies for `extra` are installed.
 
@@ -2786,6 +2791,13 @@ class DeepAgentsApp(App):
         Built alongside `_discovered_skills`.
         """
 
+        self._skill_trust_denied: set[str] = set()
+        """Resolved skill directories the user declined to trust this session.
+
+        Prevents re-prompting for the same untrusted location after a deny
+        within a single run.
+        """
+
         # Media
         # Lazily imported here to avoid pulling image dependencies into
         # argument parsing paths.
@@ -9630,6 +9642,28 @@ class DeepAgentsApp(App):
                 theme_reload_ok = False
                 logger.warning("Failed to reload user themes", exc_info=True)
 
+            # Re-resolve and apply the theme preference so a per-terminal or
+            # global default saved by another session is picked up. This
+            # re-syncs to on-disk config using the same resolution as startup
+            # (env -> [ui.terminal_themes][TERM_PROGRAM] -> [ui].theme ->
+            # default), which intentionally overrides an unsaved in-session
+            # `/theme` choice. Guarded on the registry reload succeeding since
+            # the target theme must be registered before it can be applied.
+            theme_switched_to: str | None = None
+            if theme_reload_ok:
+                try:
+                    new_theme = _load_theme_preference()
+                    if new_theme != self.theme and new_theme in theme.get_registry():
+                        self.theme = new_theme
+                        self.sync_terminal_background()
+                        self.refresh_css(animate=False)
+                        theme_switched_to = new_theme
+                except Exception:
+                    logger.warning(
+                        "Failed to re-apply theme preference on reload",
+                        exc_info=True,
+                    )
+
             # Re-discover skills so autocomplete reflects any new/removed
             # skills. Run via the same exclusive-group worker used at
             # startup so any in-flight startup discovery is cancelled
@@ -9655,6 +9689,10 @@ class DeepAgentsApp(App):
             report += "\nModel config caches cleared."
             if theme_reload_ok:
                 report += "\nTheme registry reloaded."
+                if theme_switched_to is not None:
+                    entry = theme.get_registry().get(theme_switched_to)
+                    label = entry.label if entry is not None else theme_switched_to
+                    report += f"\nSwitched theme to {label}."
             else:
                 report += (
                     "\nTheme registry reload failed. Check config.toml for errors."
@@ -9791,8 +9829,15 @@ class DeepAgentsApp(App):
                 normalized_name,
                 exc_info=True,
             )
-            await _mount_error(str(exc))
-            return
+            content = await self._prompt_skill_trust_and_retry(
+                normalized_name,
+                skill_path,
+                allowed_roots,
+                fallback_error=str(exc),
+                mount_error=_mount_error,
+            )
+            if content is None:
+                return
         except OSError as exc:
             logger.warning(
                 "Filesystem error loading skill %r",
@@ -9842,6 +9887,139 @@ class DeepAgentsApp(App):
             message_kwargs=envelope.message_kwargs,
         )
 
+    async def _prompt_skill_trust_and_retry(
+        self,
+        skill_name: str,
+        skill_path: str | Path,
+        allowed_roots: list[Path],
+        *,
+        fallback_error: str,
+        mount_error: Callable[[str], Awaitable[None]],
+    ) -> str | None:
+        """Prompt to trust an out-of-bounds skill directory, then reload it.
+
+        Mirrors the MCP project-trust flow: when containment fails, the user is
+        asked once to allow the resolved target directory. Allowing persists the
+        decision, extends the in-session containment allowlist, and retries the
+        read. Denying (or a prior deny this session) shows the original error.
+
+        Args:
+            skill_name: Normalized skill name, for messaging.
+            skill_path: Path to the skill's `SKILL.md`.
+            allowed_roots: Containment roots to extend on approval.
+            fallback_error: Original `PermissionError` message to show on deny.
+            mount_error: Callback to surface an error in the chat log.
+
+        Returns:
+            The skill content on approval and successful reload, or `None` when
+                the user declined or the retry failed (an error was mounted).
+        """
+        from deepagents_code.skills.load import load_skill_content
+        from deepagents_code.skills.trust import trust_skill_dir
+        from deepagents_code.widgets.skill_trust import SkillTrustScreen
+
+        try:
+            target_dir = await asyncio.to_thread(_resolve_parent_dir, skill_path)
+        except (OSError, RuntimeError):
+            # Resolving the skill path can fail (e.g. a symlink loop introduced
+            # in the window after the first containment check raised). Fail
+            # closed with the original error rather than letting the worker
+            # exception escape unhandled — this mirrors the retry block below,
+            # which already guards its own resolve.
+            logger.warning(
+                "Could not resolve skill path %r for the trust prompt; refusing",
+                skill_path,
+                exc_info=True,
+            )
+            await mount_error(fallback_error)
+            return None
+
+        if target_dir in self._skill_trust_denied:
+            await mount_error(fallback_error)
+            return None
+
+        try:
+            allowed = await self._push_screen_wait(
+                SkillTrustScreen(skill_name, target_dir)
+            )
+        except Exception:
+            # This runs inside `_invoke_skill`'s `except PermissionError` block,
+            # so an error escaping the modal push would not be caught by that
+            # method's sibling handlers and would surface as an unhandled worker
+            # crash. Fail closed: treat a modal failure as a deny.
+            logger.warning(
+                "Skill trust prompt failed to display for %s; refusing",
+                target_dir,
+                exc_info=True,
+            )
+            self._skill_trust_denied.add(target_dir)
+            await mount_error(fallback_error)
+            return None
+        if not allowed:
+            self._skill_trust_denied.add(target_dir)
+            await mount_error(fallback_error)
+            return None
+
+        if not await asyncio.to_thread(trust_skill_dir, target_dir):
+            # The modal told the user this location would be remembered for
+            # future sessions. Persisting failed (read-only/full `.state`), so
+            # surface that: we honor the approval this session, but they will be
+            # asked again next launch. Logging alone would silently break that
+            # promise.
+            logger.warning("Could not persist skill trust for %s", target_dir)
+            self.notify(
+                "Approved for this session, but the decision could not be "
+                "saved — you may be asked again next time.",
+                severity="warning",
+                markup=False,
+            )
+
+        target_path = Path(target_dir)
+        for roots in (allowed_roots, self._skill_allowed_roots):
+            if target_path not in roots:
+                roots.append(target_path)
+
+        def _retry() -> str | None:
+            return load_skill_content(str(skill_path), allowed_roots=allowed_roots)
+
+        try:
+            content = await asyncio.to_thread(_retry)
+        except PermissionError:
+            # Containment failed *after* the target dir was allowlisted, so the
+            # skill path must now resolve somewhere else — a symlink swap during
+            # the prompt window. Refuse and flag it distinctly from a plain read
+            # error. (PermissionError is an OSError subclass, so this must come
+            # first.)
+            logger.warning(
+                "Skill %r resolved outside the approved directory on retry "
+                "(target may have changed since approval); refusing",
+                skill_name,
+                exc_info=True,
+            )
+            await mount_error(
+                f"Could not load skill: {skill_name}. Its location changed "
+                "after you approved it, so it was not read.",
+            )
+            return None
+        except OSError:
+            logger.warning(
+                "Retry load failed for skill %r after trust",
+                skill_name,
+                exc_info=True,
+            )
+            await mount_error(
+                f"Could not load skill: {skill_name} after granting trust.",
+            )
+            return None
+
+        if content is None:
+            await mount_error(
+                f"Could not read content for skill: {skill_name}. "
+                "Check that the SKILL.md file exists, is readable, "
+                "and is saved as UTF-8.",
+            )
+        return content
+
     async def _handle_skill_command(self, command: str) -> None:
         """Handle a `/skill:<name>` command by loading and invoking a skill.